Macbook Harden Script - Printable Version

Code:
#!/bin/bash

# Enable FileVault (Full Disk Encryption)
sudo fdesetup enable

# Set a firmware password
sudo firmwarepasswd -setpasswd -mode command -setmode command

# Enable Firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

# Disable remote login (SSH)
sudo systemsetup -f -setremotelogin off

# Disable automatic login
sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES

# Enable Gatekeeper (Allow apps from the App Store and identified developers)
sudo spctl --master-enable

# Enable automatic updates
sudo softwareupdate --schedule on

# Set a screen lock with password (Note: This step must be done manually)
echo "Please go to System Preferences > Security & Privacy > General and enable 'Require password [time] after sleep or screen saver begins'"

# Disable guest user
sudo dscl . -create /Users/Guest UserShell /usr/bin/false
sudo dscl . -create /Users/Guest RealName "Guest User"
sudo dscl . -create /Users/Guest UniqueID 600
sudo dscl . -create /Users/Guest PrimaryGroupID 201
sudo dscl . -create /Users/Guest NFSHomeDirectory /Library/Guests
sudo dscl . -create /Users/Guest IsHidden 1

# Disable unnecessary services and ports (Manual review and disable if not needed)

# Review and adjust sharing settings (Manual review and enable only necessary services)
echo "Please go to System Preferences > Sharing and enable only necessary services."

echo "Security hardening complete. Please review each change to ensure it aligns with your requirements."